skuhn

65 ms·

571.
by skuhn 12y ago
It's always hard to be absolutely certain about what goes on at a company, but I'm pretty confident about Dropbox not participating in PRISM (defined as a government system that automatically collects considerable data from within
572.
by skuhn 12y ago
Dropbox is mentioned in the PRISM slide deck as being a desired participant, not an actual participant. I worked at Dropbox when those slides were released, and none of us on the operations team knew what it could possibly be talking about.
573.
by skuhn 12y ago
I worked for a company that used ImageMagick for compositing images together and resizing them to one of ~60 sizes (different page locations, device types, etc.). While it worked, and it was at the core of the company's technology, it
574.
by skuhn 12y ago
Not to mention that their syntax is wrong and won't trigger the vulnerability in the first place. env x='() {.:;.} ; echo yo' *line 0: syntax error near unexpected token `{.:'* It should be: env x='() {
575.
by skuhn 12y ago
No, there is no local privilege escalation. So at best this can hit the four machines in the world that run bash CGI scripts as root. Also, their apt-get command is incorrect. apt-get update updates the local repo cache, apt-get -yy inst
576.
by skuhn 12y ago
Loggly seems to be all about running In The Cloud, so that seems unlikely. EC2 instances running haproxy would mitigate a number of the problems they discussed with using ELBs but the inability to use VIPs (with vrrp or ucarp) in AWS means
577.
by skuhn 12y ago
Lots of other comments have torn this article apart (and justifiably so), but I still feel the need to pile on. In their docs, Loggly only gives out one API endpoint: logs-01.loggly.com. It is referenced as the endpoint for HTTP, HTTPS, sys
578.
by skuhn 12y ago
This is not a vulnerability, it is intended functionality. Some scripts undoubtedly depend on overloading a shell builtin command with a function (even though it is gross). The post's proposed exploit path is not possible on Linux and
579.
by skuhn 12y ago
Any service where you also control the client doesn't really benefit from the use of SSL certs issued by trusted public CAs, other than the simplicity of doing things the same way you always have. Imagine a file storage service accessi
580.
by skuhn 12y ago
I haven't tried it, but that is the relevant line from the PHP C source. sendmail_cmd is a variable, so you're right, it will be expanded to whatever. popen()'s man page says: FILE *popen(const char *command, const char *
581.
by skuhn 12y ago
Likewise, it's been a thorn in my side up until now. And it is safe, POSIX sh does not support exported functions, that is a bash-ism.
582.
by skuhn 12y ago
Taking funding from a venture capitalist means giving them an ownership stake and a say in how your business operates. If you don't trust them, don't get along with them, and don't see eye to eye with them on basic fundamenta
583.
by skuhn 12y ago
It is correct that PHP's mail() function will fork a shell: sendmail = popen(sendmail_cmd, "w"); Which calls /bin/sh to execute sendmail_cmd. However, two things must also be true: 1. /bin/sh is bas
584.
by skuhn 12y ago
In my case, both linkedin and tumblr e-mail addresses have been leaked somehow. It was definitely not a simple dictionary attack, based on the addresses I used.
585.
by skuhn 12y ago
> They're such different bugs that they're hard to compare. I mentioned it because people are having a field day comparing the two (which results in some good old fashioned fear mongering). A random sampling: CNet: 'B
586.
by skuhn 12y ago
bash on OSX is vulnerable, but as you say, there are few attack vectors. A client OSX machine with a stock config is not vulnerable. At a minimum, you have to enable a network service like printer sharing (CUPS), remote login (ssh), web sha
587.
by skuhn 12y ago
I have also started receiving spam at my tumblr-only address.
588.
by skuhn 12y ago
They won't have to backport the fix, there is a patch directly against bash-3.2 (which ships in OSX): http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 They do update bash occasionally, ev
589.
by skuhn 12y ago
There are many pros and cons to EC2 vs managed hosting vs operating it yourself. I meant that in this particular case, you are likely to have fewer headaches from this issue in your own datacenter because: 1. You probably don't run Xen
590.
by skuhn 12y ago
You might not be vulnerable at all (if it is a Xen problem), or you might not have to patch so urgently. More to the point, by operating your own systems, the maintenance window is set by your staff and not Amazon.
591.
by skuhn 12y ago
'Total assets' is listed as 16.45mm, which includes 1.1mm in cash and 5.59mm in long term investments. So yes, I suppose if they are counting Alibaba / YJ stock in long term investments (which makes sense), then it is being d
592.
by skuhn 12y ago
This is something that I spent a lot of time on a few years ago. Some of the HTTP accelerator servers I ran were in countries or sites that were more problematic than others, so it was desirable to not locate SSL keys on them. Instead of ha
593.
by skuhn 12y ago
In my experience, there is an astonishing amount of work to do just keeping your head above water. Particularly in a corporate environment where you spend 90% of your time getting permission and buy-in for the other 10% where real work occu
594.
by skuhn 12y ago
The mandate to use Yahoo Mail for corp users is from the last month or two. Perhaps it does not cover the entire company, but my understanding was that it did. Yahoo corp mail was previously Exchange (!). Also awful, but at least it support
595.
by skuhn 12y ago
To briefly follow up now that Alibaba had its first day of trading and shot up in value: YHOO market cap : 41.86bn + liabilities : 3.7bn = 45.56bn (-0.44bn) Cash on hand = 1.1bn + Other assets = 15.3bn + Cash from Alibaba sal
596.
by skuhn 12y ago
They do still have some smart people, but I don't think anyone or any amount of money can turn things around for them in any meaningful way. Their pre-Marissa acquisitions were almost universally wastes of time and money. It's too
597.
by skuhn 12y ago
Zero chance any real company will pay 40% in taxes on stock sales. They have their ways. http://online.barrons.com/news/articles/SB521330210524938232...
598.
by skuhn 12y ago
You're right, I adjusted the numbers a bit. That leaves $9.7bn of free money laying around, if you can get at it. (minus taxes and discounts on the value, etc.)
599.
by skuhn 12y ago
I don't see how anything has been adapted here. This isn't Uber getting some different deal versus existing taxi companies. Airbnb always owed hotel tax, and now they are getting around to collecting it. They played the "oh,
600.
by skuhn 12y ago
Consider that if I have a bunch of gold bars sitting in a vault somewhere, I don't have to sell them to make money off of them. I can borrow money against their perceived value, currently practically for free. This becomes particularly

More ›